The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by interpolating untrusted user data into prompts for the image generation model. User-provided values for fields like video titles and concepts are inserted into templates without boundary markers.
Ingestion points: User-supplied text for [TITLE], [CONCEPT], and [DESCRIPTION] placeholders in prompting/formulas.md and prompting/guide.md.
Boundary markers: Absent. The templates do not use delimiters or instructions to ignore embedded commands in user input.
Capability inventory: The skill performs network operations via curl and executes local Python scripts in scripts/generate-batch.sh.
Sanitization: Absent. User input is interpolated directly into the prompt strings.
[COMMAND_EXECUTION]: The scripts/generate-batch.sh script executes various shell commands to manage the generation workflow. It uses curl to communicate with the API, wc for file processing, and mkdir for output management. The script uses shlex.quote in its internal Python helper to safely handle headers before execution in eval, which is a recognized security best practice for command construction.
[REMOTE_CODE_EXECUTION]: The batch generation script uses python3 to execute dynamically generated Python code via heredocs. This code performs critical tasks such as image resizing (using the Pillow library) and parsing JSON responses from the vendor API. Although the Python source is provided as a static template within the script, it constitutes runtime code generation and execution.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.novoads.ai for image uploads, generation estimates, and fetching completed thumbnail assets. These operations target the vendor's official API infrastructure and are consistent with the skill's stated purpose.

generate-youtube-thumbnail